fixed bug where user could access admin pages